- cross-posted to:
- [email protected]
- [email protected]
- [email protected]
- cross-posted to:
- [email protected]
- [email protected]
- [email protected]
Summary
- Google’s proposal, Web Environment Integrity (WEI), aims to send tamper-proof information about a user’s operating system and software to websites.
- The information sent would help reduce ad fraud and enhance security, but it also raises concerns about user autonomy and control over devices.
- The authors argue that implementing WEI could lead to websites blocking access for users not on approved systems and browsers.
- They express worries about companies gaining more control over users’ devices and the potential for abuse.
- The authors emphasize that users should have the final say over what information their devices share.
- Remote attestation tools, like WEI, might have their place in specific contexts but should not be implemented on the open web due to potential negative consequences.
- The authors advocate for preserving user autonomy and the openness of the web, emphasizing that users should be the ultimate decision-makers about their devices.
Joke:
Two pieces of string walk into a bar. The first piece of string asks for a drink. The bartender says, “Get lost. We don’t serve pieces of string.”
The second string ties a knot in his middle and messes up his ends. Then he orders a drink.
The bartender says, “Hey, you aren’t a piece of string, are you?” The piece of string says, “Not me! I’m a frayed knot.”
You must log in or register to comment.
Can someone tell me how it can be “tamper proof”? Any encryption key inside chrome can be extracted and used to sign anything the user might want to send back.
The attester here is really mostly Google’s Android/Play Services/(ChromeOS) team, not Google’s Chrome team. Chrome is really just responsible for passing it along and potentially adding some more information like what kind of extensions are in use, but the real validator is above Chrome entirely.
There will not really be a worthwhile key inside Chrome (there might be one that does nothing by itself); it’ll be backed by the existing per-device-unique key living inside your phone’s secure enclave. Extracting one key would just cause Google to ban it. That attestation covers the software in the secure enclave, your device’s running OS, bootloader unlock state and a couple of other things along those lines; the OS, guaranteed to be unmodified by the hardware attestation layer, then adds extra stuff on top like the .apk hash of the browser. The browser, guaranteed to be unmodified by the OS layer, can add things like extension info if it wants to.
SafetyNet/Play Integrity have both software and hardware modes, but all Android+Google Services phones released in the previous 6? or so years have been required to have hardware backed attestation support, which has no known bypass. The existing “Universal SafetyNet Fix” pretends to be a phone without hardware support which Google begrudgingly accepts… for now. But the day where Google will just screw over older phones is getting increasingly closer, and they already have the power to force hardware backed attestation for device-specific features like NFC payments and DRM support.
On Apple devices, Apple has parallels via their secure enclaves in the form of App Attest/DeviceCheck. On Windows desktops, there could be a shoddy implementation with TPMs (fortunately they’re not quite powerful enough to do this kind of attestation in a tamper-proof way; Microsoft’s Pluton chips might have some secret sauce we haven’t yet seen, though). On Linux desktops… nope, ain’t no support for this coming anytime ever.
Ok I assumed you were thinking of something like TPM on the desktop as I couldn’t imagine any other way around it. For android the hardware backed attestation support is like tpm as well, no? Surely there’s a bypass for it if one wants to but there hasn’t been a reason to do it yet.
Edit :reading up on it, a lot relies on the encryption keys baked into the hardware and being impossible to read, right? If that remains to be the case, then ye I can imagine that would be an issue. Security will once again becomes the Trojan horse for exploitation
The idea is that it would be similar to hardware attestation in Android. In fact, that’s where Google got the idea from.
Basically, this is the way it works:
-
You download a web browser or another program (possibly even one baked into the OS, e.g. working alongside/relying on the TPM stuff from the BIOS). This is the “attester”. Attesters have a private key that they sign things with. This private key is baked into the binary of the attester (so you can’t patch the binary).
-
A web page sends some data to the attester. Every request the web page sends will vary slightly, so an attestation can only be used for one request - you cannot intercept a “good” attestation and reuse it elsewhere. The ways attesters can respond may vary so you can’t just extract the encryption key and sign your own stuff - it wouldn’t work when you get a different request.
-
The attester takes that data and verifies that the device is running stuff that corresponds to the specs published by the attester - “this browser, this OS, not a VM, not Wine, is not running this program, no ad blocker, subject to these rate limits,” etc.
-
If it meets the requirements, the attester uses their private key to sign. (Remember that you can’t patch out the requirements check without changing the private key and thus invalidating everything.)
-
The signed data is sent back to the web page, alongside as much information as the attester wants to provide. This information will match the signature, and can be verified using a public key.
-
The web page looks at the data and decides whether to trust the verdict or not. If something looks sketchy, the web page has the right to refuse to send any further data.
They also say they want to err towards having fewer checks, rather than many (“low entropy”). There are concerns about this being used for fingerprinting/tracking, and high entropy would allow for that. (Note that this does explicitly contradict the point the authors made earlier, that “Including more information in the verdict will cover a wider range of use cases without locking out older devices.”)
That said - we all know where this will go. If Edge is made an attester, it will not be low entropy. Low entropy makes it harder to track, which benefits Google as they have their own ways of tracking users due to a near-monopoly over the web. Google doesn’t want to give rivals a good way to compete with user tracking, which is why they’re pushing “low-entropy” under the guise of privacy. Microsoft is incentivized to go high-entropy as it gives a better fingerprint. If the attestation server is built into Windows, we have the same thing.
-
Who would of thought to let an Ad company running everything would be a good thing.
Fuck google
Install Firefox
Firefox it is again?
The problem is that Google has such a monopoly over web browsers that Firefox will most probably have to follow and implement this shit as well.
Smells like “this website is only compatible with Internet Explorer 7 or higher” kind of stuff, those were bad back then, it will be a lot worse now.it will be a lot worse now
On the other hand: A website implementing such a functionality does not want me as a user. That’s fine. I’ll find the information elsewhere or give them useless date from within a VM. Starting and stopping minimalist single-purpose VMs isn’t hard nowadays.
It’s easy for us as we are tech literate, but I mostly think of the average person that “doesn’t care about privacy and personal data”. We’re also not Google’s main demographic. When most websites use this kind of shit, it will be extremely hard for everyone to get away from it.
but I mostly think of the average person that “doesn’t care about privacy and personal data”
I stopped thinking of them. But yes, those people will have their data stolen by Google, as usual. But those people also don’t care one single bit about that.
To be fair, those people are my girlfriend, her parents, mine, my friends and such. When you see the damage a company like Facebook has done to the world, I would definitely try not to continue giving them any more power to fuck shit up. Giving a DRM like tool to Google could be absolutely devastating for the free web and the open internet.
According to this comment, the changes Google is making will tell websites if you’re in a vm or not.
Comment text if there are linking problems:
The idea is that it would be similar to hardware attestation in Android. In fact, that’s where Google got the idea from.
Basically, this is the way it works:
-
You download a web browser or another program (possibly even one baked into the OS, e.g. working alongside/relying on the TPM stuff from the BIOS). This is the “attester”. Attesters have a private key that they sign things with. This private key is baked into the binary of the attester (so you can’t patch the binary).
-
A web page sends some data to the attester. Every request the web page sends will vary slightly, so an attestation can only be used for one request - you cannot intercept a “good” attestation and reuse it elsewhere. The ways attesters can respond may vary so you can’t just extract the encryption key and sign your own stuff - it wouldn’t work when you get a different request.
-
The attester takes that data and verifies that the device is running stuff that corresponds to the specs published by the attester - “this browser, this OS, not a VM, not Wine, is not running this program, no ad blocker, subject to these rate limits,” etc.
-
If it meets the requirements, the attester uses their private key to sign. (Remember that you can’t patch out the requirements check without changing the private key and thus invalidating everything.)
-
The signed data is sent back to the web page, alongside as much information as the attester wants to provide. This information will match the signature, and can be verified using a public key.
-
The web page looks at the data and decides whether to trust the verdict or not. If something looks sketchy, the web page has the right to refuse to send any further data.
They also say they want to err towards having fewer checks, rather than many (“low entropy”). There are concerns about this being used for fingerprinting/tracking, and high entropy would allow for that. (Note that this does explicitly contradict the point the authors made earlier, that “Including more information in the verdict will cover a wider range of use cases without locking out older devices.”)
That said - we all know where this will go. If Edge is made an attester, it will not be low entropy. Low entropy makes it harder to track, which benefits Google as they have their own ways of tracking users due to a near-monopoly over the web. Google doesn’t want to give rivals a good way to compete with user tracking, which is why they’re pushing “low-entropy” under the guise of privacy. Microsoft is incentivized to go high-entropy as it gives a better fingerprint. If the attestation server is built into Windows, we have the same thing.
-
Won’t a User Agent Switcher be enough? Firefox has an extension like this and they even recommend it
All the way. Don’t settle for just chrome plating.
Firefox and Qwant as search engine is enough?
Qwant has a nice idea but they lag behind a lot.
With Google search results increasingly swamped with SEO-laden drivel, I’ve found the gap between Google and alternatives like Qwant and DDG has shrunk a lot recently. The little guys have improved a bit, but Google has also got worse.
Google became shit. I haven’t used it much in years. Sometimes it’s more useful though. Brave search is my go to. Simply because it has a brighter future than ddg and qwant. Qwant is mismanaged imo. Marketing is crap, products not working correctly, target group is wrong etc… brave serves nice summaries for stuff you look up.
Most other search engines use Bing or Google, Qwant is one of the few that implement their own entirely. While I agree that it’s not as good as the other two, it also has a minuscule amount of market share and in turn fewer resources.
That’s news to me. In the past years it just proxied bing
And uBlock Origin. There’s some other decent privacy addons too like Privacy Badger, Decentraleyes and Chameleon.
I’m a happy Vivaldi user (features and configurability to me are more important!) but I’m sure this will be implemented in the Chromium open source platform and not exclusively in Chrome (like some other features).
Always has been
I am not entirely sure about this.
I was always someone who used “an alternative”. Back in the days I was an avid Netscape user, then I used the Mozilla suite, then Firefox when it still was named Phoenix, then Firefox actually named Firefox (😄) … but it went downhill. The fast and sleek browser got slower and more outdated over time.
There were times when even Internet Explorer was more modern! Firefox had UI, core, and all tabs running in one single process, which meant, one website alone being able to not only crash the tab, but also all other tabs and the UI and the core - while IE started to implement having different processes for individual tabs.
At one point I switched to Chromium and eventually to Vivaldi because Chromium - in comparison to Vivaldi - is basically unconfigurable. Vivaldi also has a very good mobile version and I have full synchronization between a minimum of 5 devices (yes, I mean it! I really depend on synchronization, I have my Arch PC, an Ubuntu Laptop, an Arch laptop, my Android phone, and a Windows laptop - all of them are regularly used). This is something I need and is a deal-breaker.
Also extensions. There are two extensions I don’t want to leave behind. Both use MV3, one can be triggered for the current tab, one is automatically activated on one specific site.
Maybe I should check out Firefox again, depending on what Vivaldi does regarding WEI.
Firefox now has Firefox Sync which allows seamless switching between devices and the performance of Firefox is generally on par with Chrome, sometimes faster. It also has a pretty dang big library of extensions.
I was there for the single process Firefox when everyone else went multiprocess. It was then that I also switched away from FF, too.
I’m back on it now though (for past 9 months or so, since I heard about Google’s intention with Chrome.)
Firefox and Safari are my daily drivers, and it’s pretty chill. Edge is my backup if I must.
Modern Firefox is more “modern” looking than Chrome in my opinion. Also, iirc each tab is now its own thread.
is there is anyway to use chromecast with firefox?
thats the only reason im still attached to chrome
There is fx_cast, but it’s not on the same level as Chromecast Integration in Chrome.
The answer seems to be sometimes. There’s a way to natively do it on Android or with an extension on Mac or Linux, there may be an extension for windows too tho.
At this point, I only keep Chrome around for the odd website that only works on Chrome. It’s astonishing how quickly Google is burning through good will lately.
Most of the times, the websites check the “user agent string” of the browser. If you can change the user agent to chrome while using those websites, you can eliminate the need of keeping chrome around.
The worrying thing is how many websites may accept this standard. We can choose to use other browsers, sure. But the vast majority of users are uninformed chrome users. They won’t see a change in their day to day web usage. But Firefox, and other Chromium-based browsers like brave and Vivaldi are choosing to not adopt it. It’s only a matter of time before ad blocking doesn’t work on those browsers because major publishers implement this to ensure their content is properly paywalled.
Get chameleon extension for Firefox and spoof having chrome for those sites. Which is what google is trying to prevent
Google sees that their business is at risk.
Primarily Google is an advertisement company. And so their top priority is to profile you to serve you targeted ads. Every single product of Google has this number one priority.
Why not show you ads on any of their own websites then, like google docs, forms, slides, etc. I get that they show you ads kn YouTube, but that doesn’t have Google in the name. Do they want users to not associate ‘Google’ websites as being overrun with ads, while trying to that to as many other websites and apps as possible?
That, and those platforms are also at the core of their business offering. You’d think it shouldn’t be that hard for them to just offer a business version of those apps that is ad free. But in my experience administering a g-suite org for a couple years, they are absolutely lazy enough to just shovel users on the literal exact same thing they give to the general public.
I’ve been warning people that Google making up their own web standards will end in disaster, for years.
No single entity should be allowed to dictate standards. I’m sure multiple businesses would be interested in going along with this standard, though, so we need something of an internet bill of rights to protect against this sort of thing.
Your computer should say what you tell it to say - so if I want to spoof my browser and OS I can do that right? Right?
Yes. And you should be able to retain that ability.
The magic words are “user-agent header in http protocol”
Also the goal is not for everyone to spoof everyone else, but the goal is to not trust any information you are given by a browser. A good developer would always find ways to bypass any limits with that so it would be useless anyway.
If this comes live it won’t be so easy. Many operating systems will probably not allow to turn this garbage off or spoof it. Especially android.
Yes Theres browser extensions that do this. I tried one and didn’t work but then today tried chameleon and it worked for a site I need for work that only allows chrome.
That’s because they check your user agent.
This API aims to break those kinds of extensions, making it impossible to spoof a user agent or certain kind of machine.
deleted by creator
deleted by creator
If you just can’t use Firefox, switch to edge or opera.
Unfortunately Opera has been bought out by a Chinese company since 2016. I don’t think that’s any better than what Google is doing.
But… why?
deleted by creator
No. Chromium is far, far from being free of Google’s clutches. If you must use chromium-based browsers (you really shouldn’t) you can try ungoogled-chromium.
Google really scared of those adblockers it seems
Hmm… WEI seems to serve to reduce ad frauds, not as a direct attack on blocking ads, except maybe for those ad blockers that attempt to maximize expenses for the advertisers.
Stopping ad blocking is very much in their interest, and this system can very quickly be used to do just that.
This is Google we’re talking about, their days of not being evil are long gone.
Like 25 years gone…
dOn’T bE eViL
They said it out loud and stopped using that years ago.
Well, according to the proposal, it doesn’t send it to websites. It sends all your data to an attestation server, AKA Google probably, and the attestation server sends stuff to the website.
Can you rewrite attestation server traffic with a proxy server? What if you had a proxy server that had hundreds of clients and scrambled the requests?
Of course it does, how else are they gonna make website owners pay for the data access?
I can see myself not being able to avoid the Google ecosystem but using Chrome solely to access Gmail/Drive/etc. In fact I could picture someone writing a Firefox extension to dock Chrome tabs into Firefox. That would be a laugh.
The first half of this post (headline included) seems to just be the propagandized version of all the Web Environment Integrity posts that have been coming out lately.
Use firefox with brave or Duckduckgo.
Brave is even worse than chrome. They would sell your mother if they could get away with it.
I still don’t understand how Brave became the face of the privacy focused browser. Doing some cryptocurrency related shit is the biggest red flag that an entity should not be trusted now.
It’s a shining example of advertising controlling the narrative.
